11 ms·

Disclaimer: worked for Meraki (now Cisco Meraki) for several years. Generally, halfway decent wireless APs are all targeted at the enterprise market. Consumer

Disclaimer: worked for Meraki (now Cisco Meraki) for several years. Generally, halfway decent wireless APs are all targeted at the enterprise market. Consumer hardware is a brutal race to the bottom, as lay consumers aren't qualified to compare options based on anything but price and UI. Ubiquiti was an outlier in trying to bring enterprise features to the consumer market The problem for enthusiasts and small business/home office setups like yours are that both the enterprise market (e.g. Meraki) and the premium consumer market (e.g. Google WiFi) focus heavily on ease of management - cloud controllers are table stakes these days, not a controversial feature. Part of that premium that Meraki, Aruba, and that class of enterprise supplier charge is about having a trustworthy and secured backend. Note, however, that roaming between APs is a feature of the 802.11 standard; you just need to have all your APs on the same layer 2 (802.x) network, and using the same SSID and credentials. No fancy hardware required, and you can even mix and match vendors.

fullstop 6y ago
Surely 802.11r has a purpose, yes?
- betterunix2 6y ago
  Faster handoffs between APs.
- cassianoleal 6y ago
  Yes, roaming by sharing SSID and passcode is a world of pain. 802.11r solves all those pains, I've been using it on OpenWRT for months without a glitch.
  - synergy20 6y ago
    how do you enable 802.11r on openwrt? on which model of router
    - mikehotel 6y ago
      Install the wpad pkg and 802.11r should show up in wireless config screens. See https://forum.openwrt.org/t/802-11r-fast-roaming-in-luci/11730 https://forum.openwrt.org/t/802-11r-fast-roaming-in-luci/117...
      - cassianoleal 6y ago
        Pretty much that. It's also very simple nowadays. you just tick the box on the Wireless Security tab, and check that the mobility domain match between all the APs - it should by default, I think it's derived from the SSID.
    - kelnos 6y ago
      Be aware that there might be compatibility issues. I enabled it on a pair of OpenWRT-running APs, and the handoff worked fine for my laptop, but my phone would claim to be successfully associated/authenticated with the new AP, but traffic wouldn't flow. Turning off 802.11r fixed the issue completely, and it turns out I don't really need it after all, as my devices seem to roam properly and the reauth is pretty quick.
  - slmkbh 6y ago
    I have a couple of AP AC Lites running openwrt and 802.11r, works fine except on Xiaomi phones apparently... I never tried the unifi though, flashed openwrt within 15 minutes of receiving the APs
  - fullstop 6y ago
    Yes, it's why I use 802.11r. It works with most devices, although the one which does not support it makes me laugh. Nintendo Switch will not switch from one AP to another. It holds on, tooth and nail, to whichever BSSID it used when it first connected. My kids have to go into settings, reconnect, and move on.
    - tmottabr 6y ago
      afaik that is a design decision by nintendo. i think it did support roaming in the past and they disabled it in an OS update.
- azernik 6y ago
  It's a performance thing. With standard 802.11 roaming, you have to reassociate and reauthenticate to the new AP. While this process is underway, you can't pass any traffic. For open networks or simple auth schemes like WPA2 single-password, this isn't very noticeable; however, for heavier-weight auth schemes like 802.1x this pause is substantial and is especially noticeable on voice/video calls. 802.11r is a scheme for caching the authentication info, letting you avoid the 802.1x round-trip to a central auth server. For a 5-AP network, usually with shared-password WPA2, it's not necessary.
SV_BubbleTime 6y ago
My personal experience with Meraki has been the very definition of vendor lock-in. The security appliance was relatively cheap, then we saw the fine print that the total bandwidth was artificially limited and increased only adaquetly two product levels up. Sorry Mr BubbleTime, you need to buy a new applicance and a new license. Your old one is worth nothing and non-transferable, watch it rot. The switches seem absurdly expensive when you consider the 5-7 year licensing costs. And the quality is poor at best considering Meraki went and pushed a firmware update that bricked every fan in every 48 port switch we had. But you have the security appliance so it “only makes sense” to pay for these switches. We had an IPSEC incompatibility between a vendor with an ASA and our Meraki gear. The solution was to buy a Cisco device just for that one connection. All in all, it’s passable, but because of the lock-in it’s not like I have a cost effective choice to get away from it. I wouldn’t chose it again. That said, it does offer a mediocre IT tech a single pane of glass they have to try to mess up. Of all the Meraki factors I’ve learned and considered, that it is cloud-based is the least important towards my recommendation or lack of. There are lots of people that would be happy to explain all the ways my experience is wrong, but whatever. Short version, I wouldn’t do it again.
- foobiekr 6y ago
  Is there a community for this kind of discussion at this point? When I was an admin, and then later working in networking in the 2000s, there were tons of very active mailing lists, not just for hardcore networking but for IT-oriented stuff, mostly all faded to a shadow of their former selves. I'd be particularly interested in comparisons of Meraki/Mist/etc. for small enterprise and campus.
  - Silhouette 6y ago
    Some of the relevant subreddits have decent discussions from time to time. The grandfather is /r/networking, but if you look at its sidebar, there's a long list of other subreddits for more specific subjects and individual brands. Stick to the subs for professionals rather than minor home network issues and you'll find quite a few knowledgeable people and plenty of anecdotes both good and bad about different brands etc.
judge2020 6y ago
> having a trustworthy and secured backend. Ubiquiti had a secured backend - their screw-up was not doing MFA on their admin accounts. I would still like if there was an option for a local-only control panel.
- red_phone 6y ago
  For their UniFi line, at least, you don't have to use their cloud controller. You can self-host.
  - cle 6y ago
    This is what I do. I host a controller in AWS on an EC2 instance in my account. It works great.
    - dijit 6y ago
      Out of interest, why wouldn't you host it on something like a raspberry pi? Having your local network depend on an external network makes my old school sysadmin bones tingle for some reason.
      - gregmac 6y ago
        The Ubiquiti controller is not needed for general operation, unless you're using a guest hotspot. Otherwise if it's offline you just lose ability to do configuration and it's data/stats logging.
        julianz 6y ago
        It's also needed if you want to have any control over SSID's such as enabling/disabling on a schedule, bandwidth limiting and so on.
        thrixton 6y ago
        Hah, that's a dream world where enabling/disabling SSID's ever worked properly. They have a good UI, good hardware but the software seems half baked. Originally with the switch to the "new settings", the schedules were switched between the AP's and the UDM, not sure about a dedicated cloud controller. Great product, poor QA I think.
passivate 6y ago
We use Meraki MR/MX stuff at our office and are generally happy with the value & service. The MS stuff though, thats another story. Do you guys have plans to enter the sub $2K tier with L3 devices?
- azernik 6y ago
  I haven't worked at Meraki since 2015; sorry, can't help you out on that one. I will note that as of 2015, "L3 switching" (i.e. hardware-accelerated IP routing) hardware was expensive as hell. I believe that on the software side, dropping new hardware into the existing hardware-routing infrasturcture is fairly easy, but I don't actually know because I didn't work much on MS hardware.
admax88q 6y ago
> Note, however, that roaming between APs is a feature of the 802.11 standard; In theory yes, but man do a lot of devices have terrible roaming heuristics. "I can still see beacons so id better stay here even though i havent received a packet in the last minute. Wouldnt want to pay the time cost of associating with that other BSS that has 5X the signal"
- jhugo 6y ago
  You can fix this on the AP side with minimum RSSI or data rate control. But that would probably push you over to either Ubiquiti (and the similar “cloud based” options) or the enterprise market to get those features, unfortunately.
  - KozmoNau7 6y ago
    On Mikrotik you can set the minimum allowed data rate, at least. That should kick clients with marginal connections to a hopefully better AP.
- londons_explore 6y ago
  The key issue is the protocol seems to have no ability to associate with multiple BSS's together. It's so nearly there. The power management stuff means that even with single a physical radio one can associate with multiple BSS's on different frequencies by telling one BSS to hold packets for you while tuning in to the other frequency. All that's needed to make it reality is a way to tell a BSS "If I fail to ACK a link layer packet, please forward it via the wired network to this other BSS to send to me instead". Then a client could be connected to multiple BSS's, send packets via either, receive packets via whichever one it is currently tuned into, and not lose any packets while switching.
- AndyMcConachie 6y ago
  Do people _really_ need wifi roaming in their homes? I have multiple cheap APs setup in my house using the same SSID and it's fine. As long as I'm not holding a realtime conversation and moving around between APs I never have any problems. And since I almost never hold a Skype call while walking through my house I almost never have any issues.
emmelaich 6y ago
Worth noting that Meraki have a small business option now: https://www.meraki-go.com/ https://www.meraki-go.com/
- tumblewit 6y ago
  Wow this is great and seems like a direct competitor to UniFi. Few years back when I was researching meraki I found it way too pricey for small business over UniFi but this makes much more sense now.
- thiagocsf 6y ago
  Says “cloud managed” on every piece of equipment. Do you know if that’s optional?
  - emmelaich 6y ago
    Not optional on any Meraki gear afaik.
PostThisTooFast 6y ago
Yeah, it's incredible how pathetically bad the home-networking market is. I've been through every consumer router and wound up with a Ubiquiti EdgeRouter and AP. Ubiquiti's software and support are absolute dogshit. And I did NOT set up a "controller," which is not (and should not be) necessary in your HOUSE. This seems to confound Ubiquiti and other users, which in itself is rather pathetic. Stop putting your shit in "the cloud," where it's subject to the whims and failures of a third party. When will people learn?
StreamBright 6y ago
I still remember the first Meraki device. It was so good. I used it a lot.
sly010 6y ago
> Note, however, that roaming between APs is a feature of the 802.11 standard; you just need to have all your APs on the same layer 2 (802.x) network, and using the same SSID and credentials. No fancy hardware required, and you can even mix and match vendors. Not exactly. There are extensions to pre-authenticate with an AP (802.11r) for truly seamless roaming without packet drop or delay and for AP controlled roaming (802.11k) where the current AP tells you your options to roam to. This last one is important because the AP has generally better information about the network than the client and because the clients are not that great at managing this. I am sure there are other extensions too, but afaik cheap APs don't implement these.
- azernik 6y ago
  Depends on your definition of "seamless". The base standard's behavior requires a reassociation to the new cell (i.e. AP i.e. BSSID). This introduces a gap in coverage, but for simple setups like the 5-AP one IgorPortola is talking - I assumed that this was using shared-password auth - the gap's length is functionally 0. 802.11r gets rid of that gap, which is important when using heavier-weight authentication protocols like 802.1x. (Note that by 802.x in my original I meant not 802.1x, but rather the set of standards including 802.3 (ethernet) and 802.11 (wifi))

fullstop 6y ago

Surely 802.11r has a purpose, yes?

betterunix2 6y ago
Faster handoffs between APs.
cassianoleal 6y ago
Yes, roaming by sharing SSID and passcode is a world of pain. 802.11r solves all those pains, I've been using it on OpenWRT for months without a glitch.
- synergy20 6y ago
  how do you enable 802.11r on openwrt? on which model of router
  - mikehotel 6y ago
    Install the wpad pkg and 802.11r should show up in wireless config screens. See https://forum.openwrt.org/t/802-11r-fast-roaming-in-luci/11730 https://forum.openwrt.org/t/802-11r-fast-roaming-in-luci/117...
    - cassianoleal 6y ago
      Pretty much that. It's also very simple nowadays. you just tick the box on the Wireless Security tab, and check that the mobility domain match between all the APs - it should by default, I think it's derived from the SSID.
  - kelnos 6y ago
    Be aware that there might be compatibility issues. I enabled it on a pair of OpenWRT-running APs, and the handoff worked fine for my laptop, but my phone would claim to be successfully associated/authenticated with the new AP, but traffic wouldn't flow. Turning off 802.11r fixed the issue completely, and it turns out I don't really need it after all, as my devices seem to roam properly and the reauth is pretty quick.
- slmkbh 6y ago
  I have a couple of AP AC Lites running openwrt and 802.11r, works fine except on Xiaomi phones apparently... I never tried the unifi though, flashed openwrt within 15 minutes of receiving the APs
- fullstop 6y ago
  Yes, it's why I use 802.11r. It works with most devices, although the one which does not support it makes me laugh. Nintendo Switch will not switch from one AP to another. It holds on, tooth and nail, to whichever BSSID it used when it first connected. My kids have to go into settings, reconnect, and move on.
  - tmottabr 6y ago
    afaik that is a design decision by nintendo. i think it did support roaming in the past and they disabled it in an OS update.
azernik 6y ago
It's a performance thing. With standard 802.11 roaming, you have to reassociate and reauthenticate to the new AP. While this process is underway, you can't pass any traffic. For open networks or simple auth schemes like WPA2 single-password, this isn't very noticeable; however, for heavier-weight auth schemes like 802.1x this pause is substantial and is especially noticeable on voice/video calls. 802.11r is a scheme for caching the authentication info, letting you avoid the 802.1x round-trip to a central auth server. For a 5-AP network, usually with shared-password WPA2, it's not necessary.

SV_BubbleTime 6y ago

My personal experience with Meraki has been the very definition of vendor lock-in. The security appliance was relatively cheap, then we saw the fine print that the total bandwidth was artificially limited and increased only adaquetly two product levels up. Sorry Mr BubbleTime, you need to buy a new applicance and a new license. Your old one is worth nothing and non-transferable, watch it rot. The switches seem absurdly expensive when you consider the 5-7 year licensing costs. And the quality is poor at best considering Meraki went and pushed a firmware update that bricked every fan in every 48 port switch we had. But you have the security appliance so it “only makes sense” to pay for these switches. We had an IPSEC incompatibility between a vendor with an ASA and our Meraki gear. The solution was to buy a Cisco device just for that one connection. All in all, it’s passable, but because of the lock-in it’s not like I have a cost effective choice to get away from it. I wouldn’t chose it again. That said, it does offer a mediocre IT tech a single pane of glass they have to try to mess up. Of all the Meraki factors I’ve learned and considered, that it is cloud-based is the least important towards my recommendation or lack of. There are lots of people that would be happy to explain all the ways my experience is wrong, but whatever. Short version, I wouldn’t do it again.

foobiekr 6y ago
Is there a community for this kind of discussion at this point? When I was an admin, and then later working in networking in the 2000s, there were tons of very active mailing lists, not just for hardcore networking but for IT-oriented stuff, mostly all faded to a shadow of their former selves. I'd be particularly interested in comparisons of Meraki/Mist/etc. for small enterprise and campus.
- Silhouette 6y ago
  Some of the relevant subreddits have decent discussions from time to time. The grandfather is /r/networking, but if you look at its sidebar, there's a long list of other subreddits for more specific subjects and individual brands. Stick to the subs for professionals rather than minor home network issues and you'll find quite a few knowledgeable people and plenty of anecdotes both good and bad about different brands etc.

judge2020 6y ago

> having a trustworthy and secured backend. Ubiquiti had a secured backend - their screw-up was not doing MFA on their admin accounts. I would still like if there was an option for a local-only control panel.

red_phone 6y ago
For their UniFi line, at least, you don't have to use their cloud controller. You can self-host.
- cle 6y ago
  This is what I do. I host a controller in AWS on an EC2 instance in my account. It works great.
  - dijit 6y ago
    Out of interest, why wouldn't you host it on something like a raspberry pi? Having your local network depend on an external network makes my old school sysadmin bones tingle for some reason.
    - gregmac 6y ago
      The Ubiquiti controller is not needed for general operation, unless you're using a guest hotspot. Otherwise if it's offline you just lose ability to do configuration and it's data/stats logging.
      - julianz 6y ago
        It's also needed if you want to have any control over SSID's such as enabling/disabling on a schedule, bandwidth limiting and so on.
        thrixton 6y ago
        Hah, that's a dream world where enabling/disabling SSID's ever worked properly. They have a good UI, good hardware but the software seems half baked. Originally with the switch to the "new settings", the schedules were switched between the AP's and the UDM, not sure about a dedicated cloud controller. Great product, poor QA I think.

passivate 6y ago

We use Meraki MR/MX stuff at our office and are generally happy with the value & service. The MS stuff though, thats another story. Do you guys have plans to enter the sub $2K tier with L3 devices?

azernik 6y ago
I haven't worked at Meraki since 2015; sorry, can't help you out on that one. I will note that as of 2015, "L3 switching" (i.e. hardware-accelerated IP routing) hardware was expensive as hell. I believe that on the software side, dropping new hardware into the existing hardware-routing infrasturcture is fairly easy, but I don't actually know because I didn't work much on MS hardware.

admax88q 6y ago

> Note, however, that roaming between APs is a feature of the 802.11 standard; In theory yes, but man do a lot of devices have terrible roaming heuristics. "I can still see beacons so id better stay here even though i havent received a packet in the last minute. Wouldnt want to pay the time cost of associating with that other BSS that has 5X the signal"

jhugo 6y ago
You can fix this on the AP side with minimum RSSI or data rate control. But that would probably push you over to either Ubiquiti (and the similar “cloud based” options) or the enterprise market to get those features, unfortunately.
- KozmoNau7 6y ago
  On Mikrotik you can set the minimum allowed data rate, at least. That should kick clients with marginal connections to a hopefully better AP.
londons_explore 6y ago
The key issue is the protocol seems to have no ability to associate with multiple BSS's together. It's so nearly there. The power management stuff means that even with single a physical radio one can associate with multiple BSS's on different frequencies by telling one BSS to hold packets for you while tuning in to the other frequency. All that's needed to make it reality is a way to tell a BSS "If I fail to ACK a link layer packet, please forward it via the wired network to this other BSS to send to me instead". Then a client could be connected to multiple BSS's, send packets via either, receive packets via whichever one it is currently tuned into, and not lose any packets while switching.
AndyMcConachie 6y ago
Do people _really_ need wifi roaming in their homes? I have multiple cheap APs setup in my house using the same SSID and it's fine. As long as I'm not holding a realtime conversation and moving around between APs I never have any problems. And since I almost never hold a Skype call while walking through my house I almost never have any issues.

emmelaich 6y ago

Worth noting that Meraki have a small business option now: https://www.meraki-go.com/ https://www.meraki-go.com/

tumblewit 6y ago
Wow this is great and seems like a direct competitor to UniFi. Few years back when I was researching meraki I found it way too pricey for small business over UniFi but this makes much more sense now.
thiagocsf 6y ago
Says “cloud managed” on every piece of equipment. Do you know if that’s optional?
- emmelaich 6y ago
  Not optional on any Meraki gear afaik.

PostThisTooFast 6y ago

Yeah, it's incredible how pathetically bad the home-networking market is. I've been through every consumer router and wound up with a Ubiquiti EdgeRouter and AP. Ubiquiti's software and support are absolute dogshit. And I did NOT set up a "controller," which is not (and should not be) necessary in your HOUSE. This seems to confound Ubiquiti and other users, which in itself is rather pathetic. Stop putting your shit in "the cloud," where it's subject to the whims and failures of a third party. When will people learn?

StreamBright 6y ago

I still remember the first Meraki device. It was so good. I used it a lot.

sly010 6y ago

> Note, however, that roaming between APs is a feature of the 802.11 standard; you just need to have all your APs on the same layer 2 (802.x) network, and using the same SSID and credentials. No fancy hardware required, and you can even mix and match vendors. Not exactly. There are extensions to pre-authenticate with an AP (802.11r) for truly seamless roaming without packet drop or delay and for AP controlled roaming (802.11k) where the current AP tells you your options to roam to. This last one is important because the AP has generally better information about the network than the client and because the clients are not that great at managing this. I am sure there are other extensions too, but afaik cheap APs don't implement these.

azernik 6y ago
Depends on your definition of "seamless". The base standard's behavior requires a reassociation to the new cell (i.e. AP i.e. BSSID). This introduces a gap in coverage, but for simple setups like the 5-AP one IgorPortola is talking - I assumed that this was using shared-password auth - the gap's length is functionally 0. 802.11r gets rid of that gap, which is important when using heavier-weight authentication protocols like 802.1x. (Note that by 802.x in my original I meant not 802.1x, but rather the set of standards including 802.3 (ethernet) and 802.11 (wifi))